CVE-2026-21525: Windows Remote Access Connection Manager null pointer dereference DoS

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityThe flaw is only a local denial of service with no privilege gain, but it is in CISA KEV with a near-term remediation deadline and affects a wide range of Windows versions.

What it is

Windows Remote Access Connection Manager contains a null pointer dereference (CWE-476) that lets an unauthorized attacker deny service locally. The flaw is rated CVSS 3.1 6.2 (Medium) with high availability impact and no confidentiality or integrity impact. It affects a broad set of Windows 10, Windows 11 and Windows Server releases, so unpatched endpoints and servers remain exposed to local denial of service.

Impact

An attacker who can run code or trigger the vulnerable path on the host can crash or hang the Remote Access Connection Manager, disrupting remote access and VPN connectivity for that system. No data theft or code execution is gained; the effect is availability loss.

Attack surface

The CVSS vector is AV:L/PR:N/UI:N, meaning the attack is local, requires no privileges and no user interaction. It is reached by an unauthenticated local actor able to interact with the affected service on the machine.

Exploitation

CVE-2026-21525 is listed in CISA KEV with a due date of 2026-03-03, indicating known exploitation, though EPSS 30-day probability is modest at 0.05042 (91.9th percentile). No ransomware campaign use is documented.

What to do

• Apply the Microsoft vendor update for CVE-2026-21525 to all affected Windows 10, Windows 11 and Windows Server versions as the first action.
• Follow CISA BOD 22-01 guidance and the KEV required action; if patching is not immediately possible, apply vendor mitigations or discontinue use of the affected product.
• Restrict local interactive and service access on affected hosts to trusted users and processes to reduce the local attack surface.
• Monitor the Remote Access Connection Manager service for unexpected crashes or restarts and investigate repeated failures.
• Track KEV remediation deadlines and verify patch compliance across the full affected product list.

Detection

• Monitor Windows event logs and service control manager entries for Remote Access Connection Manager (RasMan) crashes, stops or unexpected restarts.
• Watch for repeated application error or WER reports referencing null pointer faults in Remote Access Connection Manager binaries.
• Correlate local process execution with service failure events on affected hosts to identify deliberate triggering attempts.
• Use the third-party detection script referenced in the advisory to check for the vulnerable condition on unpatched systems.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.